Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows 8 internet explorer.ständig werbefenster, Tabs,downloads,browsergames die sich automatisch öffnen oder angezeigt werden (https://www.trojaner-board.de/157099-windows-8-internet-explorer-staendig-werbefenster-tabs-downloads-browsergames-automatisch-oeffnen-angezeigt.html)

steffenh25 31.07.2014 18:23
Windows 8 internet explorer.ständig werbefenster, Tabs,downloads,browsergames die sich automatisch öffnen oder angezeigt werden
 
Hallo ich bin ein absoluter Laie was Computer betrifft, hier meine Probleme:ich habe einen Laptop mit Windows 8, wenn ich im Internet bin öffnen sich dauernd Werbefenster auf allen Seiten und kann dann meistens fast nichts mehr von der Seite erkennen die ich geöffnet habe ich versuche dann immer die fenster zu schliessen aber dann öffnen sich automatisch ein oder mehrere neue Tabs wie z.b.: gom.opentri.net oder irgendwelche browsergames oder ich soll aufeinmal irgendwelche Windows Programme aktualisieren. habe mir deshalb neulich Avira pro gekauft und dachte damit kann ich das Problem beheben aber das war nicht der Fall. kann mir bitte jemand sagen oder helfen was ich tun kann?

schrauber 31.07.2014 18:36
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


steffenh25 31.07.2014 19:19
FRST Additions Logfile:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2014 01
Ran by Steffen at 2014-07-31 20:11:18
Running from C:\Users\Steffen\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 3.4.117.01527 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.) Hidden
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.1.0.570 - Amazon Services LLC)
Antivirus Pro (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
ASUS InstantOn (HKLM-x32\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 3.0.4 - ASUS)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.13 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.2.2 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 2.0.4 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 1.0.36 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.03.0005 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.1.5 - ASUS)
ASUS WebStorage Sync Agent (HKLM-x32\...\ASUS WebStorage) (Version: 1.1.18.159 - ASUS Cloud Corporation)
ASUSDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4126.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.7 - Atheros Communications Inc.)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0027 - ASUS)
Avira Savings Advisor (HKLM-x32\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira) <==== ATTENTION
Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Buzzdock (HKLM\...\{ac225167-00fc-452d-94c5-bb93600e7d9a}) (Version:  - Alactro LLC) <==== ATTENTION
Cobra 11 - Burning Wheels (remove only) (HKLM-x32\...\BurningWheels) (Version:  - )
CoolSaleeCoupon (HKLM-x32\...\{0C516764-8CFC-C2FE-7BB0-A50A646E4DCD}) (Version:  - CiOollSAAleCoeupon) <==== ATTENTION
Cut the Rope (x32 Version: 3.0.2.38 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DIE SIEDLER - Das Erbe der Könige - Gold Edition (HKLM-x32\...\{E08DE897-B6AF-4DFF-9E90-131E80C876B4}) (Version: 1.00.0000 - Blue Byte)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Google Update Helper (x32 Version: 1.3.23.0 - PriceMeter) Hidden <==== ATTENTION
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2875 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MyBitCast 2.0 (HKLM-x32\...\MyBitCast) (Version: 2.0 - ASUS)
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - JDi Backup Ltd) <==== ATTENTION
Peggle (x32 Version: 2.2.0.95 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6804 - Realtek Semiconductor Corp.)
Re-Markable (HKLM-x32\...\6012E6E1-47AD-E0F6-3E54-AB2A946D006D) (Version:  - Re-Markable-software) <==== ATTENTION
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.2.14 - Client Connect LTD) <==== ATTENTION
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
TowerTilt (HKLM\...\TowerTilt) (Version: 2014.05.27.155325 - TowerTilt)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
VO Package (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
Wajam (HKLM-x32\...\Wajam) (Version: 2.15 - Wajam) <==== ATTENTION
webssearches uninstaller (HKLM-x32\...\webssearches uninstaller) (Version:  - webssearches) <==== ATTENTION
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.0.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.10.5 - WildTangent) Hidden
Windows Driver Package - ASUS (ATP) Mouse  (11/09/2012 1.0.0.153) (HKLM\...\5AB9160B769DD2E134ADCB8010377DECA2479378) (Version: 11/09/2012 1.0.0.153 - ASUS)
Windows Live (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.41.1 - ASUS)
WinRAR 5.01 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WPM17.8.0.3442 (HKLM-x32\...\WPM) (Version: 17.8.0.3442 - Cherished Technololgy LIMITED) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: C:\Windows\Tasks\APSnotifierPP1.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\free  ven-firefoxinstaller.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-chromeinstaller.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-firefoxinstaller.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\Re-Markable Update.job => ?
Task: C:\Windows\Tasks\Re-Markable_wd.job => ?
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => ?
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => ?
Task: C:\Windows\Tasks\SpeedUpMyPC Maintenance.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\SpeedUpMyPC Startup.job => ? <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-07-27 17:31 - 2014-07-01 20:58 - 03162944 _____ () C:\Users\Steffen\AppData\Local\Amazon Music\Amazon Music Helper.exe
2013-04-09 11:06 - 2012-11-02 09:19 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2014-05-29 00:39 - 2014-07-31 18:01 - 00096544 _____ () C:\Program Files (x86)\TowerTilt\bin\TowerTilt.BrowserAdapter.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/31/2014 06:10:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: Die App „DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (07/31/2014 04:34:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: BurningWheelsHi.exe, Version: 6.3.1.1, Zeitstempel: 0x49020ca8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x42c7fff4
ID des fehlerhaften Prozesses: 0x1d194
Startzeit der fehlerhaften Anwendung: 0xBurningWheelsHi.exe0
Pfad der fehlerhaften Anwendung: BurningWheelsHi.exe1
Pfad des fehlerhaften Moduls: BurningWheelsHi.exe2
Berichtskennung: BurningWheelsHi.exe3
Vollständiger Name des fehlerhaften Pakets: BurningWheelsHi.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: BurningWheelsHi.exe5

Error: (07/31/2014 03:04:14 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/30/2014 06:14:21 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.17028 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 135b8

Startzeit: 01cfac0c1d9efca0

Endzeit: 46

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: 8edf45a6-1804-11e4-be88-d850e6a28b19

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (07/29/2014 04:59:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: Die App „DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (07/29/2014 02:51:05 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: Die App „Microsoft.Camera_8wekyb3d8bbwe!Microsoft.Camera“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (07/29/2014 09:45:07 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/27/2014 06:20:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: McSmtFwk.exe, Version: 4.1.185.0, Zeitstempel: 0x50c7b310
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16912, Zeitstempel: 0x536464ba
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000e9d19
ID des fehlerhaften Prozesses: 0x287b8
Startzeit der fehlerhaften Anwendung: 0xMcSmtFwk.exe0
Pfad der fehlerhaften Anwendung: McSmtFwk.exe1
Pfad des fehlerhaften Moduls: McSmtFwk.exe2
Berichtskennung: McSmtFwk.exe3
Vollständiger Name des fehlerhaften Pakets: McSmtFwk.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McSmtFwk.exe5

Error: (07/27/2014 06:14:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: McUICnt.exe, Version: 5.1.169.0, Zeitstempel: 0x50712b57
Name des fehlerhaften Moduls: McSmtStr.dll, Version: 4.1.185.0, Zeitstempel: 0x50c7b31e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001db5c
ID des fehlerhaften Prozesses: 0x2be70
Startzeit der fehlerhaften Anwendung: 0xMcUICnt.exe0
Pfad der fehlerhaften Anwendung: McUICnt.exe1
Pfad des fehlerhaften Moduls: McUICnt.exe2
Berichtskennung: McUICnt.exe3
Vollständiger Name des fehlerhaften Pakets: McUICnt.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McUICnt.exe5

Error: (07/27/2014 05:50:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.17028 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 25ce0

Startzeit: 01cfa9b1848cbd4a

Endzeit: 47

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: a74fa519-15a5-11e4-be87-d850e6a28b19

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


System errors:
=============
Error: (07/31/2014 06:22:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (07/31/2014 06:08:30 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/31/2014 05:42:06 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/31/2014 00:39:36 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 10:56:33 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 10:31:07 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 10:01:43 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 09:29:27 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 09:04:13 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 08:22:45 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4


Microsoft Office Sessions:
=========================
Error: (07/31/2014 06:10:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default

Error: (07/31/2014 04:34:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: BurningWheelsHi.exe6.3.1.149020ca8unknown0.0.0.000000000c000000542c7fff41d19401cfacc9ed7db559C:\Program Files (x86)\Cobra 11 - Burning Wheels\BurningWheelsHi.exeunknownd298003e-18bf-11e4-be88-d850e6a28b19

Error: (07/31/2014 03:04:14 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/30/2014 06:14:21 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe10.0.9200.17028135b801cfac0c1d9efca046C:\Program Files\Internet Explorer\iexplore.exe8edf45a6-1804-11e4-be88-d850e6a28b19

Error: (07/29/2014 04:59:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default

Error: (07/29/2014 02:51:05 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: Microsoft.Camera_8wekyb3d8bbwe!Microsoft.Camera

Error: (07/29/2014 09:45:07 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/27/2014 06:20:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: McSmtFwk.exe4.1.185.050c7b310ntdll.dll6.2.9200.16912536464bac000037400000000000e9d19287b801cfa96f1e7e8c9bC:\PROGRA~1\COMMON~1\McAfee\Platform\MSM\McSmtFwk.exeC:\Windows\SYSTEM32\ntdll.dllf5c05bfb-15a9-11e4-be87-d850e6a28b19

Error: (07/27/2014 06:14:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: McUICnt.exe5.1.169.050712b57McSmtStr.dll4.1.185.050c7b31ec0000005000000000001db5c2be7001cfa9b5dff21c6eC:\PROGRA~1\COMMON~1\McAfee\Platform\McUICnt.exeC:\PROGRA~1\COMMON~1\McAfee\Platform\MSM\McSmtStr.dll1e1aa43d-15a9-11e4-be87-d850e6a28b19

Error: (07/27/2014 05:50:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe10.0.9200.1702825ce001cfa9b1848cbd4a47C:\Program Files\Internet Explorer\iexplore.exea74fa519-15a5-11e4-be87-d850e6a28b19


==================== Memory info ===========================

Percentage of memory in use: 25%
Total physical RAM: 6029.67 MB
Available physical RAM: 4466.91 MB
Total Pagefile: 20365.67 MB
Available Pagefile: 18379.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:220.6 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:398.07 GB) (Free:397.93 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================
--- --- ---

steffenh25 31.07.2014 19:49
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 01
Ran by Steffen (ATTENTION: The logged in user is not administrator) on CONNY on 31-07-2014 20:10:13
Running from C:\Users\Steffen\Desktop
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
() C:\Users\Steffen\AppData\Local\Amazon Music\Amazon Music Helper.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\APRP\aprp.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\TowerTilt\bin\TowerTilt.BrowserAdapter.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

Hi schrauber hoffe das ist das richtige und du kannst mir jetzt weiterhelfen.


       
Code:

       
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2014 01
Ran by Steffen at 2014-07-31 20:11:18
Running from C:\Users\Steffen\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 3.4.117.01527 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.) Hidden
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.1.0.570 - Amazon Services LLC)
Antivirus Pro (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
ASUS InstantOn (HKLM-x32\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 3.0.4 - ASUS)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.13 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.2.2 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 2.0.4 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 1.0.36 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.03.0005 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.1.5 - ASUS)
ASUS WebStorage Sync Agent (HKLM-x32\...\ASUS WebStorage) (Version: 1.1.18.159 - ASUS Cloud Corporation)
ASUSDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4126.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.7 - Atheros Communications Inc.)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0027 - ASUS)
Avira Savings Advisor (HKLM-x32\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira) <==== ATTENTION
Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Buzzdock (HKLM\...\{ac225167-00fc-452d-94c5-bb93600e7d9a}) (Version:  - Alactro LLC) <==== ATTENTION
Cobra 11 - Burning Wheels (remove only) (HKLM-x32\...\BurningWheels) (Version:  - )
CoolSaleeCoupon (HKLM-x32\...\{0C516764-8CFC-C2FE-7BB0-A50A646E4DCD}) (Version:  - CiOollSAAleCoeupon) <==== ATTENTION
Cut the Rope (x32 Version: 3.0.2.38 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DIE SIEDLER - Das Erbe der Könige - Gold Edition (HKLM-x32\...\{E08DE897-B6AF-4DFF-9E90-131E80C876B4}) (Version: 1.00.0000 - Blue Byte)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Google Update Helper (x32 Version: 1.3.23.0 - PriceMeter) Hidden <==== ATTENTION
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2875 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MyBitCast 2.0 (HKLM-x32\...\MyBitCast) (Version: 2.0 - ASUS)
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - JDi Backup Ltd) <==== ATTENTION
Peggle (x32 Version: 2.2.0.95 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6804 - Realtek Semiconductor Corp.)
Re-Markable (HKLM-x32\...\6012E6E1-47AD-E0F6-3E54-AB2A946D006D) (Version:  - Re-Markable-software) <==== ATTENTION
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.2.14 - Client Connect LTD) <==== ATTENTION
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
TowerTilt (HKLM\...\TowerTilt) (Version: 2014.05.27.155325 - TowerTilt)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
VO Package (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
Wajam (HKLM-x32\...\Wajam) (Version: 2.15 - Wajam) <==== ATTENTION
webssearches uninstaller (HKLM-x32\...\webssearches uninstaller) (Version:  - webssearches) <==== ATTENTION
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.0.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.10.5 - WildTangent) Hidden
Windows Driver Package - ASUS (ATP) Mouse  (11/09/2012 1.0.0.153) (HKLM\...\5AB9160B769DD2E134ADCB8010377DECA2479378) (Version: 11/09/2012 1.0.0.153 - ASUS)
Windows Live (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.41.1 - ASUS)
WinRAR 5.01 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WPM17.8.0.3442 (HKLM-x32\...\WPM) (Version: 17.8.0.3442 - Cherished Technololgy LIMITED) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: C:\Windows\Tasks\APSnotifierPP1.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\free  ven-firefoxinstaller.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-chromeinstaller.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-firefoxinstaller.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\Re-Markable Update.job => ?
Task: C:\Windows\Tasks\Re-Markable_wd.job => ?
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => ?
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => ?
Task: C:\Windows\Tasks\SpeedUpMyPC Maintenance.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\SpeedUpMyPC Startup.job => ? <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-07-27 17:31 - 2014-07-01 20:58 - 03162944 _____ () C:\Users\Steffen\AppData\Local\Amazon Music\Amazon Music Helper.exe
2013-04-09 11:06 - 2012-11-02 09:19 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2014-05-29 00:39 - 2014-07-31 18:01 - 00096544 _____ () C:\Program Files (x86)\TowerTilt\bin\TowerTilt.BrowserAdapter.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/31/2014 06:10:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: Die App „DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (07/31/2014 04:34:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: BurningWheelsHi.exe, Version: 6.3.1.1, Zeitstempel: 0x49020ca8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x42c7fff4
ID des fehlerhaften Prozesses: 0x1d194
Startzeit der fehlerhaften Anwendung: 0xBurningWheelsHi.exe0
Pfad der fehlerhaften Anwendung: BurningWheelsHi.exe1
Pfad des fehlerhaften Moduls: BurningWheelsHi.exe2
Berichtskennung: BurningWheelsHi.exe3
Vollständiger Name des fehlerhaften Pakets: BurningWheelsHi.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: BurningWheelsHi.exe5

Error: (07/31/2014 03:04:14 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/30/2014 06:14:21 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.17028 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 135b8

Startzeit: 01cfac0c1d9efca0

Endzeit: 46

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: 8edf45a6-1804-11e4-be88-d850e6a28b19

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (07/29/2014 04:59:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: Die App „DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (07/29/2014 02:51:05 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: Die App „Microsoft.Camera_8wekyb3d8bbwe!Microsoft.Camera“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (07/29/2014 09:45:07 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/27/2014 06:20:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: McSmtFwk.exe, Version: 4.1.185.0, Zeitstempel: 0x50c7b310
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16912, Zeitstempel: 0x536464ba
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000e9d19
ID des fehlerhaften Prozesses: 0x287b8
Startzeit der fehlerhaften Anwendung: 0xMcSmtFwk.exe0
Pfad der fehlerhaften Anwendung: McSmtFwk.exe1
Pfad des fehlerhaften Moduls: McSmtFwk.exe2
Berichtskennung: McSmtFwk.exe3
Vollständiger Name des fehlerhaften Pakets: McSmtFwk.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McSmtFwk.exe5

Error: (07/27/2014 06:14:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: McUICnt.exe, Version: 5.1.169.0, Zeitstempel: 0x50712b57
Name des fehlerhaften Moduls: McSmtStr.dll, Version: 4.1.185.0, Zeitstempel: 0x50c7b31e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001db5c
ID des fehlerhaften Prozesses: 0x2be70
Startzeit der fehlerhaften Anwendung: 0xMcUICnt.exe0
Pfad der fehlerhaften Anwendung: McUICnt.exe1
Pfad des fehlerhaften Moduls: McUICnt.exe2
Berichtskennung: McUICnt.exe3
Vollständiger Name des fehlerhaften Pakets: McUICnt.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McUICnt.exe5

Error: (07/27/2014 05:50:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.17028 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 25ce0

Startzeit: 01cfa9b1848cbd4a

Endzeit: 47

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: a74fa519-15a5-11e4-be87-d850e6a28b19

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


System errors:
=============
Error: (07/31/2014 06:22:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (07/31/2014 06:08:30 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/31/2014 05:42:06 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/31/2014 00:39:36 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 10:56:33 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 10:31:07 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 10:01:43 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 09:29:27 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 09:04:13 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (07/30/2014 08:22:45 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4


Microsoft Office Sessions:
=========================
Error: (07/31/2014 06:10:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default

Error: (07/31/2014 04:34:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: BurningWheelsHi.exe6.3.1.149020ca8unknown0.0.0.000000000c000000542c7fff41d19401cfacc9ed7db559C:\Program Files (x86)\Cobra 11 - Burning Wheels\BurningWheelsHi.exeunknownd298003e-18bf-11e4-be88-d850e6a28b19

Error: (07/31/2014 03:04:14 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/30/2014 06:14:21 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe10.0.9200.17028135b801cfac0c1d9efca046C:\Program Files\Internet Explorer\iexplore.exe8edf45a6-1804-11e4-be88-d850e6a28b19

Error: (07/29/2014 04:59:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default

Error: (07/29/2014 02:51:05 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Conny)
Description: Microsoft.Camera_8wekyb3d8bbwe!Microsoft.Camera

Error: (07/29/2014 09:45:07 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/27/2014 06:20:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: McSmtFwk.exe4.1.185.050c7b310ntdll.dll6.2.9200.16912536464bac000037400000000000e9d19287b801cfa96f1e7e8c9bC:\PROGRA~1\COMMON~1\McAfee\Platform\MSM\McSmtFwk.exeC:\Windows\SYSTEM32\ntdll.dllf5c05bfb-15a9-11e4-be87-d850e6a28b19

Error: (07/27/2014 06:14:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: McUICnt.exe5.1.169.050712b57McSmtStr.dll4.1.185.050c7b31ec0000005000000000001db5c2be7001cfa9b5dff21c6eC:\PROGRA~1\COMMON~1\McAfee\Platform\McUICnt.exeC:\PROGRA~1\COMMON~1\McAfee\Platform\MSM\McSmtStr.dll1e1aa43d-15a9-11e4-be87-d850e6a28b19

Error: (07/27/2014 05:50:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe10.0.9200.1702825ce001cfa9b1848cbd4a47C:\Program Files\Internet Explorer\iexplore.exea74fa519-15a5-11e4-be87-d850e6a28b19


==================== Memory info ===========================

Percentage of memory in use: 25%
Total physical RAM: 6029.67 MB
Available physical RAM: 4466.91 MB
Total Pagefile: 20365.67 MB
Available Pagefile: 18379.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:220.6 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:398.07 GB) (Free:397.93 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================

--- --- ---


Code:
--------------------------------------------------------------------------------

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 01
Ran by Steffen (ATTENTION: The logged in user is not administrator) on CONNY on 31-07-2014 20:10:13
Running from C:\Users\Steffen\Desktop
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
() C:\Users\Steffen\AppData\Local\Amazon Music\Amazon Music Helper.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\APRP\aprp.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\TowerTilt\bin\TowerTilt.BrowserAdapter.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

schrauber 01.08.2014 17:40
Unsere Tools brauchen immer Adminrechte!


Adware & Co. deinstallieren





Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:05 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131